"Surfshark's privacy risk score of 63 places it in the moderate-to-high risk category, comparable to mainstream services like Netflix/Spotify. The service collects extensive sensitive data including financial information, identity documents, email/SMS content, and device identifiers, then shares this data with advertising networks (AppsFlyer, Firebase, Iterable, Purchasely) for behavioral profiling and marketing purposes. Critical concerns include 10-year payment data retention, international transfers to 6+ countries, and use of automated decision-making for pricing without transparency."
surfshark Privacy Concerns & Scorecard
Surfshark collects extensive personal and sensitive data including financial information (full credit card details, SSN), identity documents (passport numbers), communications content (email and SMS), location data (Wi-Fi SSIDs), and behavioral data across multiple services
Data shared with multiple advertising and marketing partners (AppsFlyer, Firebase Analytics, Iterable, Purchasely) for behavioral profiling and ad targeting; payment processors collect extensive personal data including passport information
Payment information and credit card data retained for 10 years, customer support communications retained for 6 years, and marketing data retained indefinitely until opt-out, significantly longer than typical VPN privacy practices
Automated decision-making used to determine subscription discounts without explicit transparency on criteria or methodology; users must contact support to challenge decisions
Cookies, mobile device IDs, and tracking pixels used to deliver interest-based advertising and track user behavior across sessions; users can withdraw consent but must opt-out for each advertising partner separately
Policy disclaims absolute security guarantees and acknowledges risk of third-party interception, shifting security responsibility to users while collecting sensitive data
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, authentication, and identity verification for subscription and customer support
Payment processing and billing
Payment processing and identity verification
Email scam checking, message protection, and alternative email/number services
Service delivery, app functionality, and analytics
Behavioral advertising, marketing attribution, and analytics
Service delivery, location-based features, and network connectivity
Service analytics, security monitoring, and feature usage measurement
Customer support and service provision
Social media account linking and Alternative ID service
Cross-Platform Tracking
Surfshark uses cookies, mobile device IDs, advertising IDs, and randomized identifiers to track users across sessions and for behavioral advertising purposes. Data is shared with advertising partners (AppsFlyer, Firebase, Iterable, Purchasely) that enable cross-platform tracking and retargeting. The Dedicated IP service explicitly links online activities to the user's account, creating a permanent tracking identifier.
Tracking Methods:
Tracking Pixels and Web Beacons
Pixels and web beacons used for marketing analytics, performance measurement, and conversion attribution
Cookies
First-party and third-party cookies used to deliver interest-based advertising, measure campaign effectiveness, and enable behavioral tracking across sessions
Mobile Device Identifiers
Mobile device IDs, advertising IDs, and randomized identifiers collected for cross-device tracking and ad attribution through AppsFlyer, Firebase Analytics, and Purchasely
Analytics & Attribution Tracking
Performance marketing service providers track user behavior for sales attribution and subscription performance measurement
AI & Data Training
surfshark uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Anonymized Usage and Analytics Data
Anonymized data retained indefinitely for AI model training and improvement purposes
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed surfshark
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.